2017: As The Hardware World Turns

December 27, 2017 by 28 Comments

The year is almost over, and now it’s time to look back on the last fifty-odd weeks. What happened in this year in hacking? 2017 will go down as the beginning of another AI renaissance, although we’re not going to call it that; this year was all about neural nets and machine learning and advancements resulting from the development of self-driving cars and very beefy GPUs. Not since the 80s have we seen more work in ‘AI’ fields. What will it amount to this time around the hype cycle? Find out in a few years.

Biohacking was big this year, and not just because people are installing RFID tags and magnets in their hands. CRISPR is allowing for Star Trek-style genome hacking, and this year saw in vivo experiments to enable and disable individual genes in rat models. Eventually, someone is going to get a Nobel for CRISPR.

We’re going to Mars, and soon — very soon — a SpaceX Falcon Heavy is going to either lob a Tesla Roadster into solar orbit or the Atlantic Ocean. We learned about the BFR that will take dozens of people to Mars in a single launch. Boeing and Lockheed think they can compete with the Elon Musk PR powerhouse. The Bigelow Aerospace inflatable module passed its in-flight test on the ISS, giving the space station a new storage closet. Even in space, amazing stuff is happening this year.

Is that it? Not by a long shot. This year has seen some of the coolest hacks we’ve ever seen, and some of the dumbest security breaches ever. Hackaday is doing awesome. What else did 2017 have? Read on to find out.

Continue reading “2017: As The Hardware World Turns” →

The Dark Arts: SQL Injection And Secure Passwords

March 9, 2016 by 41 Comments

As the year of 2005 was drawing to a close, a website known as Myspace was basking in popularity. With millions of users, the site was the most popular social networking site in the world. It was unique in that it let users use HTML code to customize their Myspace page. Most of us, c’mon…admit it….had a Myspace page. The coding part was fun! But not everything was changeable with code. You could only upload up to 12 images and the Relationship Status drop-down menu only had a few options to choose from. These limitations did not sit well with [Samy Kamkar], a 19 year old hacker out of Los Angeles.

sql_03
Source

It didn’t take [Samy] long to figure out how to trick the site to let him upload more images and change his relationship status to a customized “in a hot relationship”. After hoodwinking the Myspace site with some simple hacks, he realized he could do just about anything he wanted to with it. And this is where things get interesting. It took just over a week to develop a script that would force people who visited his page to add him as a friend. But that wasn’t enough. He then programmed the script to copy itself onto the visitor’s page. [Samy] had developed a self-propagating worm.

The script went live as [Samy] went to bed. He woke up the next morning with 200 friends requests. An hour later the number had doubled. [Samy] got worried and sent an anonymous email to the webmaster warning of the worm. It was ignored. By 1:30PM that day, he had over 6,000 friends request. And like any good hacker worth his weight in floppy drives, his sense of humor had him program the script to also add his name to each visitor’s Heroes List. This angered many people, who deleted him from their page, only to get reinfected moments later when they visited another (infected) page.

[Samy’s] script was raging out of control.  As the evening closed in, his friends count had reached 919,664. It would top the 1 million mark just before Myspace took their servers offline to figure out what was going on. Two hours later, the site was back up. [Samy’s] profile page had been deleted.

[Samy] had used a technique known as cross-site scripting (XSS) to pull off his hack. We’ll touch on XSS in a later article. For now, we’re going to stick to the basics – proper passwords and SQL Injection.

Continue reading “The Dark Arts: SQL Injection And Secure Passwords” →

Conference Badges Are The Newest Form Of Hardware Art

October 7, 2015 by 22 Comments

About four decades ago, many European truck drivers started placing electronic LED badges in their windshields. Most of them were simple; nothing more than an animated heart pierced by an arrow. It became a common distraction in the highway night panorama of that time, at least until it became illegal. Most motorists became accustomed to seeing them, and the idea of the truck drivers making a statement with electronics always stuck with me. Now I have the chance to help people make a similar statement. Conference badges are not just a way to identify those who have registered, but a fashion statement and a mark of pride for conference organizers. They’ve become an art form, and engineers always want to stretch the limits of what is possible.

Every September, we have BalCCon, an international hacker’s conference at Novi Sad, Serbia. I was asked to design a badge for the 2016 event, and this is the first (well, the second) release. It is based on the PIC18LF24K50 and consists of a circle of LEDs which randomly displays pre-defined patterns. Every badge has its own infrared transceiver (LED-receiver pair), so the fun begins when two or more badges spot each other: they go from Adagio to full on Rondo, losing their default, dull visual pattern for a more dynamic, attention grabbing one, but most importantly – they synchronize. This means that, in a group of people, all badges will play the same pattern in unison. Every badge can spread the pattern code, so the whole group, however large, soon becomes synchronized. But if one of them “gets lost” somehow, it will try to learn it back from a neighbor or it might even launch into its own, randomly generated one. Sometimes it manages to spread it further and you get to witness a battle for light show domination.

This isn’t merely a story of designing badges, but of design choices that come in on budget while achieving a look that will delight those who end up wearing the hardware.

Continue reading “Conference Badges Are The Newest Form Of Hardware Art” →

Introducing USB Armory, A Flash Drive Sized Computer

October 14, 2014 by 22 Comments

[Andrea] tipped us about USB armory, a tiny embedded platform meant for security projects. It is based on the 800MHz ARM Cortex-A8 Freescale i.MX53 together with 512MB of DDR3 SDRAM, includes a microSD card slot, a 5-pin breakout header with GPIOs/UART, a customizable LED and is powered through USB.

This particular processor supports a few advanced security features such as secure boot and ARM TrustZone. The secure boot feature allow users to fuse verification keys that ensure only trusted firmware can be executed on the board, while the ARM TrustZone enforces domain separation between a “secure” and a “normal” world down to a memory and peripheral level. This enables many projects such as electronic wallets, authentication tokens and password managers.

The complete design is open hardware and all its files may be downloaded from the official GitHub repository. The target price for the final design of the first revision is around €100.

Encrypted Drive Attack Hints At Original Xbox Hacking

June 27, 2012 by 10 Comments

[Thice] discovered a vulnerability in encrypted portable storage a few years ago. He’s just pointing about the exploit now. He mentions that he notified manufacturers long ago and we’d guess the wait to publish is to give them a chance to patch the exploit.

He calls it the Plug-Over Attack and for those who were involved with original Xbox hacking, this technique will sound very familiar. The Xbox used hard drive keys to lock the device when not in use. When you booted up the console it checked the hardware signature to make sure it was talking to the right motherboard. But if you booted up the device, then swapped the IDE cable over to a computer without cutting the power you could access the drive without having the password.

This attack is pretty much the same thing. Plug in a drive, unlock it on the victim system the normal way, then replug into the attacking system. In the image above you can see that a USB hub will work for this, but you can also use a hacked USB cable that patches a second jack into the power rail. For some reason the encryption system isn’t able to lock itself when the USB enumerates on the new system, only when power is cycled. Some of them have a timer which watches for drive idle but that still doesn’t protect from this exploit.

Brute Force A Password Protected PDF Using The BeagleBone

March 26, 2012 by 19 Comments

The biggest benefit to using the BeagleBone is it’s 700 MHz ARM processor. If you’re just messing around with basic I/O that power is going unused, but [Nuno Alves] is taking advantage of its power. He built a PDF password cracker based on the $85 development board.

We recently saw how easy it is to perform basic I/O using the BeagleBone. Those techniques are in play here, used to drive a character LCD and sample a button input from the breadboard circuit. [Nuno] even published separate posts for each of these peripheral features.

The password protected PDF file is passed to the device on a thumb drive. Since the BeagleBone is running embedded Linux you don’t need to mess around with figuring out how to read from the device. A click of the button starts the process. Currently the code just uses a brute force attack which can test more than 6000 four-character passwords per second.  This is quite slow for any password more than four or five characters long, but [Nuno] does mention the possibility of running several ARM processors in parallel, or using a dictionary (or rainbow table) to speed things up. Either way it’s an interesting project to try on the hardware. You can see his video demo of the device after the break.

Continue reading “Brute Force A Password Protected PDF Using The BeagleBone” →

Hacking A Code-protected Hard Disk

August 26, 2010 by 26 Comments

Our friend [Sprite_TM] took a look at the security of a code-protected hard disk. The iStorage diskGenie is an encrypted USB hard drive that has a keypad for passcode entry. After cracking it open he found that the chip handling the keypad is a PIC 16F883 microcontroller. He poked and prodded at the internals and found some interesting stuff. Like the fact that there is an onboard LED that blinks differently based on the code entered; one way for the right code, another for the wrong code of the right number of digits, and a third for a wrong code with the wrong number of digits. This signal could be patched into for a brute force attacking but there’s a faster way. The microcontroller checks for the correct code one digit at a time. So by measuring the response time of the chip an attacker can determine when the leading digit is correct, and reduce the time needed to crack the code. There is brute force protection that watches for multiple incorrect passwords but [Sprite_TM] even found a way around that. He attached an AVR chip to monitor the PIC response time. If it was taking longer than it should for a correct password the AVR resets the PIC before it can write incorrect attempt data to its EEPROM. This can be a slow process, but he concluded it should work. We had fun watching the Flash_Destroyer hammer away and we’d like to see a setup working to acquire the the code from this device.